Feature: allow public calendars #105

tchapi · 2023-08-15T19:00:03Z

Override the default DAVACL plugin to allow public calendars, introducing a new ACCESS_PUBLIC constant

Public calendars

They are accessible without credentials, even in the browser

Adds a new "Public" field when editing a calendar, to mark the calendar public (the user remains the sole owner as a public calendar cannot be shared for now)

We add a badge in the list to indicate it's public

Related PR: sabre-io/dav#820

1Luc1 · 2023-08-16T05:52:04Z

Having events (todos, notes also?) within the public calendar does trigger the authentication dialog.

I guess this entries don't have the unauthenticated principal

1Luc1 · 2023-08-16T06:02:02Z

Having a calender which is shared, can be changed to a public calender afterwards.

And the shared calender entry.

The Events got still synchronized. So it seems, this does work? Or should this be more restricted?

david-raine · 2023-08-27T15:38:29Z

Does this allow phonebooks to be shared?

tchapi · 2023-08-28T08:00:20Z

Thanks @1Luc1 for the tests!

Having events (todos, notes also?) within the public calendar does trigger the authentication dialog.

That's weird, I didn't have the same behavior (with events only but having the other ones should not change much)

Having a calender which is shared, can be changed to a public calender afterwards.

~~This is a bug, I'll fix asap (meaning: it should work, but it should also revoke all shared accesses since it's not used anymore and can lead to side effects)~~ ✅ Fixed

tchapi · 2023-08-28T08:01:58Z

Hello @david-raine

Does this allow phonebooks to be shared?

Unfortunately no, because the underlying sabre-io/dav library does not support it. See #87

tchapi · 2023-09-03T15:17:14Z

src/Entity/CalendarInstance.php

-    public const INVITE_STATUS_NORESPONSE = 1;
-    public const INVITE_STATUS_ACCEPTED = 2;
-    public const INVITE_STATUS_DECLINED = 3;
-    public const INVITE_STATUS_INVALID = 4;
+    public const INVITE_NORESPONSE = 1;
+    public const INVITE_ACCEPTED = 2;
+    public const INVITE_DECLINED = 3;
+    public const INVITE_INVALID = 4;

-    public const ACCESS_OWNER = 1;
+    public const ACCESS_NOTSHARED = 0;


🌱 This is mainly to comply with SabreDAV's namings

1Luc1 · 2023-09-04T06:36:11Z

Tested with branch feature/public-calendars

Thanks @1Luc1 for the tests!

Having events (todos, notes also?) within the public calendar does trigger the authentication dialog.

That's weird, I didn't have the same behavior (with events only but having the other ones should not change much)

My I be more specific about the behavior. Calling the public calender with the link ( e.g.: davis.at/dav/calendars/public/test) within the browser (firefox) will trigger the authentication dialog only if there are events within the calender. If there are no events within the calender no authentication dialog will be called.

On the other hand, subscribing to the public calender within an email client (thunderbird) doesn't open any authentication dialog, even if there is a events within the calender.

So, this behavior is acceptable for my understanding. ✅

Having a calender which is shared, can be changed to a public calender afterwards.

~~This is a bug, I'll fix asap (meaning: it should work, but it should also revoke all shared accesses since it's not used anymore and can lead to side effects)~~ ✅ Fixed

Tested ✅

1Luc1 · 2023-09-04T06:40:01Z

Found an interesting security issue, which is mainly a problem from the user and thunderbirds behavior.
If an user is created same name and the password is possible to add events to an public calendar within thunderbird. This will probably apply to non public calendars too.

Subscribe to a public calendar

Thunderbird shows the calendar as read only

Change read only within the calendar properties

Add events to calendar without providing a password ❌

Maybe add another security check within the user creation to not allow username and password the same?

tchapi · 2023-09-04T06:44:12Z

will trigger the authentication dialog only if there are events within the calender.

Oh ok, understood, thanks a lot for the clarification! I will test that behavior, I have a feeling it's some edge case on the sabre/dav side, but it should be fixable I guess, will work on it.

If an user is created same name and the password is possible to add events to an public calendar

That's "funny" ... auth is managed by sabre/dav entirely, but it might be Thunderbird that tries to login optimistically by providing the username as a password? I'll try to reproduce

tchapi · 2023-09-10T20:20:49Z

Calling the public calender with the link ( e.g.: davis.at/dav/calendars/public/test) within the browser (firefox) will trigger the authentication dialog only if there are events within the calender.

I think c1b0a00 should fix it

1Luc1 · 2023-09-11T13:11:38Z

Calling the public calender with the link ( e.g.: davis.at/dav/calendars/public/test) within the browser (firefox) will trigger the authentication dialog only if there are events within the calender.

I think c1b0a00 should fix it

Thanks. Just tested your changes and within the browser no authentication dialog appears. ✅

Unfortunately, within Thunderbird an authentication dialog shows up if subscribing to a public calender. ❌

tchapi · 2023-09-26T19:51:10Z

Unfortunately, within Thunderbird an authentication dialog shows up if subscribing to a public calender. ❌

This protocol is making me go nuts. Will have a look!

1Luc1 · 2023-10-11T17:05:49Z

Unfortunately, within Thunderbird an authentication dialog shows up if subscribing to a public calender. ❌

This protocol is making me go nuts. Will have a look!

Can you tell, when you can get another look?

tchapi · 2023-10-11T18:28:51Z

Can you tell, when you can get another look?

Unfortunately I'm quite busy on various other subjects so I can't really commit (as it takes quite some time to investigate the code for this feature); I'll do my best to finish next week

1Luc1 · 2023-10-13T09:10:57Z

Just checked your changes and tried to replicated the usecase where subscribing to a public calendar within thunderbird once worked, but couldn't really redo your changes to make it work. Now I doubt it ever worked 😖

1Luc1 · 2023-10-16T19:04:51Z

Did some further digin and found that within getAcl method from PublicAwareDAVACLPlugin adding the following checks

$node instanceof \Sabre\CalDAV\SharedCalendar
$node instanceof \Sabre\CalDAV\CalendarHome
$node instanceof \Sabre\CalDAV\Principal\User

within an own if condition returning {DAV:}unauthenticated ... won't show the authentication dialog within Thunderbird. So maybe that's something to work with?

fix: CI (2)

tchapi · 2023-10-17T22:21:24Z

Thanks for your ideas. I've tried Thunderbird and could find a potential fix that I implemented in 5874935.

tchapi · 2023-10-17T22:21:58Z

Happy to get your feedback on it. Sorry this is taking quite some time 🙇🏼

1Luc1 · 2023-10-21T16:32:21Z

Thanks for your fix. Tested it as good as possible and subscribing without username/password works as intended. Unfortunately, it is now not possible as an owner of the calender to subscribe to the calender with username and password, within Thunderbird. This is of course necessary to write events into the "public" calendar.

1Luc1 · 2023-10-21T16:41:39Z

During testing I came across a use case, which should be covered within this PR. I mentioned it some comments above and thought it was a problem. Now I think the following use case should be covered:

Having a calender which should be shared with other users. The other users have read/write access to the shared calender, meaning a group of users can edit one calender. This calender can also be a public calender.

A good example is having an event calender. Some people add/edit events within this calender and want to make the event calender public available to publicity.

Before you changed this behavior, you talked about side effects. I'm curious, are there any?

tchapi · 2023-10-27T18:58:43Z

Having a calender which should be shared with other users.

This will be another use case that I won't cover right now

it is now not possible as an owner of the calender to subscribe to the calender with username and password, within Thunderbird.

I have tested and it is possible on my side. Either you provide the credentials and uncheck "read-only" — Thunderbird will ask for the password once (you can store it), and you can create event (as the owner of the calendar). Or you check "read only" and you don't need to authenticate, and will just retrieve the events

Below: private version (auth) is the calendar I used to create both events. They appear in the "public" version (of the same calendar)

tchapi · 2023-10-27T19:00:24Z

So all in all, I think it's correctly working as of now (at last!). Will leave it open for a while and then merge to the master

1Luc1 · 2023-10-29T08:15:19Z

Thanks for re-testing. Your are right, it works as intended. Thanks again for your work!

Having a calender which should be shared with other users.
This will be another use case that I won't cover right now

Alright. Should a make a new Issue for this case?

tchapi · 2023-10-29T19:47:27Z

Your are right, it works as intended. Thanks again for your work!

🎉 🎉 🎉 🎉 🎉 🎉 🎉

Should a make a new Issue for this case?

Yes please. Given the time it takes to fiddle with sabre/dav code, I'm not promising anything though sorry. It's really a pain to find circumvention ways for something that should be standard

tchapi self-assigned this Aug 15, 2023

tchapi added the enhancement New feature or request label Aug 15, 2023

tchapi mentioned this pull request Aug 15, 2023

[Crosspost] Have a calender to be subscribable without authentication #98

Closed

tchapi linked an issue Aug 15, 2023 that may be closed by this pull request

[Crosspost] Have a calender to be subscribable without authentication #98

Closed

tchapi mentioned this pull request Aug 15, 2023

ACL Privileges for read-only user #20

Closed

tchapi force-pushed the feature/public-calendars branch 7 times, most recently from a1f7a61 to 9bc1352 Compare September 2, 2023 22:40

tchapi commented Sep 3, 2023

View reviewed changes

tchapi force-pushed the feature/public-calendars branch from 62d39b6 to c1b0a00 Compare September 10, 2023 20:32

tchapi marked this pull request as ready for review September 10, 2023 20:35

tchapi added 14 commits October 17, 2023 23:55

chore: rename consts, introduce isShared, isPublic

22ada68

feat: add form field for public calendar

7df0a06

chore: lint

7f10991

feat: add custom DAVACL plugin

3b19472

chore: update vendors

d1b201b

fix: use dav-read

f06e4db

fix: disable post actions in the browser

ba08ee3

feat: remove shared of a public calendar

5f13232

chore: separate controllers

adc12ad

chore: update composer

743976a

fix: CI

60e6ca2

fix: CI (2)

fix: CI (bis)

7ff5ebd

fix: objects must also get the correct ACL

2ed95a4

fix: OPTIONS is rejected at DAV level

5874935

tchapi force-pushed the feature/public-calendars branch from c1b0a00 to 5874935 Compare October 17, 2023 22:18

tchapi merged commit 275bada into master Oct 29, 2023
8 checks passed

tchapi deleted the feature/public-calendars branch October 29, 2023 19:47

1Luc1 mentioned this pull request Oct 30, 2023

[Feature Request] Let public calendars be shareable #117

Closed

bohwaz mentioned this pull request Aug 27, 2024

Make a calendar public sabre-io/Baikal#1039

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature: allow public calendars #105

Feature: allow public calendars #105

tchapi commented Aug 15, 2023 •

edited

Loading

1Luc1 commented Aug 16, 2023 •

edited

Loading

1Luc1 commented Aug 16, 2023

david-raine commented Aug 27, 2023

tchapi commented Aug 28, 2023 •

edited

Loading

tchapi commented Aug 28, 2023

tchapi Sep 3, 2023

1Luc1 commented Sep 4, 2023

1Luc1 commented Sep 4, 2023

tchapi commented Sep 4, 2023

tchapi commented Sep 10, 2023 •

edited

Loading

1Luc1 commented Sep 11, 2023 •

edited

Loading

tchapi commented Sep 26, 2023

1Luc1 commented Oct 11, 2023

tchapi commented Oct 11, 2023

1Luc1 commented Oct 13, 2023

1Luc1 commented Oct 16, 2023

tchapi commented Oct 17, 2023

tchapi commented Oct 17, 2023

1Luc1 commented Oct 21, 2023

1Luc1 commented Oct 21, 2023

tchapi commented Oct 27, 2023

tchapi commented Oct 27, 2023

1Luc1 commented Oct 29, 2023

tchapi commented Oct 29, 2023

Feature: allow public calendars #105

Feature: allow public calendars #105

Conversation

tchapi commented Aug 15, 2023 • edited Loading

Public calendars

Adds a new "Public" field when editing a calendar, to mark the calendar public (the user remains the sole owner as a public calendar cannot be shared for now)

We add a badge in the list to indicate it's public

1Luc1 commented Aug 16, 2023 • edited Loading

1Luc1 commented Aug 16, 2023

david-raine commented Aug 27, 2023

tchapi commented Aug 28, 2023 • edited Loading

tchapi commented Aug 28, 2023

tchapi Sep 3, 2023

Choose a reason for hiding this comment

1Luc1 commented Sep 4, 2023

1Luc1 commented Sep 4, 2023

tchapi commented Sep 4, 2023

tchapi commented Sep 10, 2023 • edited Loading

1Luc1 commented Sep 11, 2023 • edited Loading

tchapi commented Sep 26, 2023

1Luc1 commented Oct 11, 2023

tchapi commented Oct 11, 2023

1Luc1 commented Oct 13, 2023

1Luc1 commented Oct 16, 2023

tchapi commented Oct 17, 2023

tchapi commented Oct 17, 2023

1Luc1 commented Oct 21, 2023

1Luc1 commented Oct 21, 2023

tchapi commented Oct 27, 2023

tchapi commented Oct 27, 2023

1Luc1 commented Oct 29, 2023

tchapi commented Oct 29, 2023

tchapi commented Aug 15, 2023 •

edited

Loading

1Luc1 commented Aug 16, 2023 •

edited

Loading

tchapi commented Aug 28, 2023 •

edited

Loading

tchapi commented Sep 10, 2023 •

edited

Loading

1Luc1 commented Sep 11, 2023 •

edited

Loading